Overview

overview

10

Static

static

3

913377afa6...b3.exe

windows7-x64

10

913377afa6...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae5c382cb818dc3f72d77293e972e8116e52d43a3841d26eaba7ca78c32c9f69

  • Size

    407KB

  • Sample

    240417-r9ywcsda68

  • MD5

    bb7bf1677748182373214a286b83175d

  • SHA1

    bbf2b6302bb13a7a82544521265958749d74d3eb

  • SHA256

    ae5c382cb818dc3f72d77293e972e8116e52d43a3841d26eaba7ca78c32c9f69

  • SHA512

    91c04b125167c9f7b8a84681fd6a7ca4b0c5ef9027314eba4d8b8aadf3816df5942c51c53c223a8011e9e93ab72482b2c9c170f70b9c22221a968afe589d04e8

  • SSDEEP

    12288:s59DuQSVotKAgr2wgSvOrpHokkNGkaGYXu3m5:I942t8Z8pxkJ2u3m5

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

satgobleien.jumpingcrab.com:5201

Targets

    • Target

      913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe

    • Size

      582KB

    • MD5

      7bee43d88ddd5717c4059960d4f7abbb

    • SHA1

      51768285fb6047a523af3d28e3e8601fa17a181d

    • SHA256

      913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3

    • SHA512

      b3043c68445d95d1794e6557d9ce096c812c631e7d43dcdfe40850731e94ed877799fd6baf162197c888d0484a07b9c8c73994b08c9844434d3f388b768162cd

    • SSDEEP

      12288:nSQ3xl2I6NRNXDrI9GeZnbfPJJgR5lbULc1tBWpK9s3FqFLtomQ:Bf6rNX1eVXjGbt1oqFLtoN

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks